Featured Claude Code Release Notes Roundup Security Effort

What's New in Claude Code: November 2026 (v2.1.308–2.1.318)

Claude Code v2.1.308–2.1.318 (Oct 22–Nov 3, 2026): sandbox and permission fixes, ultrathink at xhigh, subagent effort, claude -p exit codes, and what to do.

• 12 min read • By Claude World

Between October 22 and November 3, 2026, Claude Code went from v2.1.308 to v2.1.318: nine versions with changelog sections (v2.1.313 and v2.1.315 have none) and 582 entries. Most are fixes: 378, alongside 78 improvements, 67 changes, 50 additions, 5 updates, 2 removals, 1 deprecation and v2.1.308’s one-line “Bug fixes and reliability improvements”. The changes that matter cluster in five places: sandbox and permission checks, effort controls for ultrathink and subagents, model handling (including the end of fast mode on Opus 4.8), exit codes and sign-in warnings for claude -p, and spend and policy controls in the Claude apps gateway.

This roundup groups them by theme, most consequential first. Every claim comes from the official CHANGELOG, and each version links to our release note. It continues the August–October roundup (v2.1.227 to v2.1.305); v2.1.306 and v2.1.307, both from October 21, fall between the two.

If you use fast mode on Opus 4.8, read Opus 4.8 Fast Mode Removal first: it ends on November 30, 2026.

The Short Version

VersionDateEntriesHeadline
v2.1.3082026-10-221”Bug fixes and reliability improvements”
v2.1.3092026-10-2279Sandbox and permission-check fixes; claude ultrareview requires workspace trust
v2.1.3102026-10-2326Monitor tool on Bedrock, Vertex and Foundry; cloud session and Remote Control permissions in Enterprise custom roles
v2.1.3112026-10-2692ultrathink runs its turn at xhigh; signed model catalog on Bedrock, Mantle, Vertex and Foundry
v2.1.3122026-10-2739Shorter system prompt for unrecognized model names; oidc.user_id_claim; claude_code.safety_event no longer sent
v2.1.3142026-10-30119permissions.blockWritesOutsideWorkingDirectories; claude -p exits 1 when startup fails; gateway upstream groups
v2.1.3162026-10-3155Opus 4.8 fast mode deprecated; CLAUDE_CODE_SUBAGENT_EFFORT and CLAUDE_CODE_DISABLE_ULTRATHINK; pooled budgets and layered policy
v2.1.3172026-11-0287A check before tools send your account email; gateway cost report; Read’s unchanged-file stub removed
v2.1.3182026-11-0384Sign-in expiry in claude auth status and claude -p; assume_role on mantle upstreams; the 2.1.288 thinking fix removed

1. Sandbox and Permission Hardening

v2.1.309 opened the period with sandbox and permission-check fixes. Before it:

  • Sandboxed Bash commands on macOS and Linux ran the shell’s startup files outside the sandbox before each command.
  • Sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config.
  • An Edit(path) deny rule didn’t block a Bash redirect to that path in some commands that also held a subshell, and worktree-isolated sessions accepted some locale-prefixed and (on zsh) arithmetic commands that the isolation guard should refuse.
  • macOS denyWrite globs missed a path’s real location when the pattern’s folder was reached through a symlink, Linux write denies lifted when a background command outlived the session, and on Windows some Set-Location or cd commands that target the current directory with extra arguments were auto-approved.

Later releases went further:

  • v2.1.314: “Added permissions.blockWritesOutsideWorkingDirectories: Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode”. It also fixed sandbox protections not applying to a worktree entered by claude -p --resume or --continue, and a settings file excluded with --setting-sources still supplying some settings, such as auto mode rules.
  • v2.1.316: --restricted sessions no longer upload files from outside the working directories when a Read allow rule covers them.
  • v2.1.317: “Added a check that asks before a web or shell tool call sends your account email address to the network”. Agent SDK hook callbacks gained onFailure: "block", so a failing callback blocks the action.
  • v2.1.318: keys typed just after sending a message, or before a slow prompt appeared, no longer answer permission prompts, and deniedMcpServers URL entries reach further (see the admin checklist below).
{
  "permissions": {
    "blockWritesOutsideWorkingDirectories": true
  }
}

What to do: update to v2.1.318. To confine file edits to your project in every permission mode, turn on blockWritesOutsideWorkingDirectories; the entry names Write, Edit and NotebookEdit, so keep the sandbox on for shell commands. Session 18: Permission Models & Security covers the rule system.

2. Effort: ultrathink, Subagents and Caps

  • v2.1.311: “Changed ultrathink in the interactive terminal to run its turn at xhigh effort on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 through Anthropic’s API; typed while Claude is working, it raises the rest of that turn”. VS Code followed in v2.1.316.
  • v2.1.316: CLAUDE_CODE_DISABLE_ULTRATHINK “turns the ultrathink keyword off”, and CLAUDE_CODE_SUBAGENT_EFFORT sets “the effort level subagents run at when nothing else names one, instead of inheriting the session’s”.
  • v2.1.317: “Changed subagents and teammates on a different model from the main conversation to use that model’s saved effort level or its default, instead of the session’s effort level”.
  • v2.1.318: a mod’s $.model.fork takes an effort option, “so a quick side job can run at low whatever effort the session uses”.
  • Since v2.1.314, when an admin caps a model’s effort, Claude Code lowers the effort, retries and says which level it uses, instead of failing every turn with “Invalid effort level”.
export CLAUDE_CODE_SUBAGENT_EFFORT=low    # subagents with no level named elsewhere
export CLAUDE_CODE_DISABLE_ULTRATHINK=1   # turns the ultrathink keyword off

What to do: ultrathink typed in the terminal or VS Code now runs that turn at xhigh on the newest models through Anthropic’s API; set CLAUDE_CODE_DISABLE_ULTRATHINK where that is unwanted, and on other providers set the effort level directly. Subagents pinned to another model no longer inherit your session’s level, and the changelog doesn’t say how that rule and CLAUDE_CODE_SUBAGENT_EFFORT combine, so where it matters, set effort: in the subagent’s frontmatter. See our ultracode and effort guide.

3. Models and Fast Mode

  • v2.1.316: “Deprecated fast mode for Opus 4.8 as of October 30, 2026; it will be removed on November 30, 2026. After removal, fast mode requests on Opus 4.8 return an error and do not fall back to standard Opus 4.8. Migrate to Opus 5.5 to keep the speedup”. The Claude Platform release notes posted the same deprecation on October 30 for API requests to claude-opus-4-8 with speed: "fast"; our removal guide walks through the move.
  • v2.1.311: on Bedrock, Mantle, Vertex and Foundry, Claude Code loads model settings from a signed file on downloads.claude.ai; CLAUDE_CODE_MODEL_CATALOG=off turns this off.
  • v2.1.312: on the same providers, model names Claude Code doesn’t recognize, “such as custom deployment names and inference profile ARNs”, get the shorter system prompt even when they front Sonnet or Haiku; CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT=0 keeps the full one.
  • v2.1.314: dotted model IDs behind an LLM gateway, such as claude-opus-4.8, no longer get an older model’s context window, output limit, effort, thinking mode and cost. Foundry (v2.1.314) and the sonnet, opus and haiku aliases on Vertex AI and Bedrock (v2.1.316) now fall back to an older model of the family instead of failing when the default or newest model isn’t available.
  • v2.1.310: the Monitor tool and plugin monitors now work on Bedrock, Vertex and Foundry, and with telemetry or nonessential traffic off; long foreground sleeps are blocked there too.
export CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT=0   # full system prompt for custom deployment names
export CLAUDE_CODE_MODEL_CATALOG=off        # don't load the signed model catalog

What to do: move fast mode work off Opus 4.8 before November 30. With custom deployment names, decide whether you want the shorter prompt, and run /model <id> once: since v2.1.316 it warns when this version doesn’t recognize the model and auto-compact will assume a 200K context window.

4. Headless and CI: Exit Codes, Sign-in Expiry and Trust

  • v2.1.314: claude -p used to exit 0 with no output when startup failed; “it now prints the error and exits 1”.
  • v2.1.317: when a full disk or quota lost its transcript or ~/.claude.json writes, claude -p exited 0; it now prints an error and, in text and json output, exits 1 (“Full NFS exports may be missed”).
  • v2.1.318: the date a stored claude.ai sign-in ends appears in claude auth status (loginExpiresAt) and in claude -p JSON results (credential_expires_at). Text output gets a one-line stderr warning starting 10 days before; at expiry, the error says so and, in claude -p, names claude auth login and claude setup-token.
  • v2.1.309: claude ultrareview requires workspace trust. It “asks on a terminal, else refuses; scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1”. Since v2.1.314, with CI set, it and claude remote-control refuse an untrusted folder at once.
  • v2.1.318 also stopped claude -p and SDK sessions reporting success when an API error cut off a reply while a mod hooked turn.step.
claude auth status                                     # includes loginExpiresAt
claude -p "Run the unit tests" --output-format json    # result includes credential_expires_at
claude ultrareview 1234 --trust-workspace              # no value; the PR number goes first

What to do: fail the job on any non-zero exit from claude -p; v2.1.314 and v2.1.317 turned two failures that used to exit 0 into exit code 1. Alert on credential_expires_at or the stderr warning, and add --trust-workspace to scripted claude ultrareview calls.

5. Reversed, Removed and Changed Behavior

Three entries undo earlier ones; the changelog gives no reason for any of them.

ChangeVersionCheck it if
claude_code.safety_event, the OpenTelemetry event v2.1.307 added, is no longer sentv2.1.312A dashboard or alert reads it
The Read tool’s “file unchanged since your last Read” stub is removed; reading an unchanged file again returns its contentv2.1.317Hooks or prompts expect the stub
The 2.1.288 fix that kept the model’s earlier thinking when resuming a conversation started on 2.1.286 or earlier is removed; that thinking can now be droppedv2.1.318You resume very old conversations

Other changes scripts may depend on:

ChangeVersion
sed -i gets the standard Bash prompt and runs as written; like other Bash edits, /rewind no longer restores itv2.1.309
DISABLE_COMPACT in settings files and a mod’s $.env.set can only turn compaction off, not back onv2.1.311
Prompt and agent hooks run at most 24 at a time per session, plus up to 12 that have waited past their event’s timeout; a timeout under 1 second counts as 1 secondv2.1.312
FORCE_HYPERLINK=false (also no and off) turns hyperlinks off instead of onv2.1.314
claude -p inside a cloud or self-hosted runner session no longer shares that session’s ID; on a runner, CLAUDE_CODE_DISABLE_NESTED_SESSION_ID=1 restores the earlier behaviorv2.1.317
Runner orchestrator ok session=… lines print at every log level on stdout, and ok and nack lines gain reason=…; update scripts that match retryable=true: or retryable=false:v2.1.318
Claude Code no longer installs or updates the IDE extension when started in an IDE terminal; use /ide from an outside terminal or your editor’s extensions viewv2.1.318

What to do: search dashboards for claude_code.safety_event, scripts for retryable= and FORCE_HYPERLINK, and settings for DISABLE_COMPACT.

6. Claude Apps Gateway: Identity, Budgets and Policy

Setting or featureVersionWhat it does
oidc.user_id_claimv2.1.312Identifies people by an id_token claim other than sub, such as Microsoft Entra ID’s oid
groups on upstreamsv2.1.314Only developers in the listed IdP groups are sent to that upstream, on failover too
pooled_budgetv2.1.316One monthly budget a group’s members share, on top of each member’s own limit, set on the spend limits admin API
managed.policy_mode: layeredv2.1.316Every policy that matches a developer applies, each merged over the ones listed below it, not only the first
Cost report, GET /v1/organizations/analytics/costv2.1.317Past spend over a date range, in total, per developer, per day or per IdP group
assume_role on mantle upstreamsv2.1.318A role in another AWS account, and per-developer AWS cost attribution

Bedrock upstreams also gained guardrail_trace (v2.1.314) and guardrail.input_tagging (v2.1.316), and since v2.1.316 a request that names a model blocked by availableModels, deniedModels or models gets a 400 naming the field.

What to do: if your identity provider’s stable ID isn’t sub, set oidc.user_id_claim. Use upstream groups and pooled_budget to route and fund teams separately, and switch to managed.policy_mode: layered only after checking how your policies stack.

7. Cloud Sessions, Remote Control, VS Code, Claude Tag and Code Review

Surface-tagged entries add up: 45 for cloud sessions, 44 for VS Code, 28 for Claude Tag, 12 for self-hosted runners, 9 for Code Review and 7 for Remote Control. The highlights:

  • Cloud sessions. Enterprise custom roles now include cloud session and Remote Control permissions (v2.1.310); scheduled tasks in Anthropic’s cloud load the plugins enabled on your claude.ai account (v2.1.314); form and link requests from MCP servers appear as cards you can answer or decline (v2.1.316, v2.1.317); and sessions on Anthropic-hosted environments can start with no repository (v2.1.318).
  • Self-hosted runners and Remote Control. --hold-idle-file and --max-hold-min keep an idle session while your host reports processes it left running (v2.1.311). Remote Control hosts, the background daemon and runners no longer fail to start sessions with spawn ENOENT after an update or version cleanup removed a still-running process’s binary (v2.1.318).
  • VS Code. Syntax coloring in code blocks (v2.1.311), idle compaction for 200K+ token conversations (v2.1.314), and Claude apps gateway sign-in from the chat panel (v2.1.316).
  • Claude Tag and Code Review. Claude Tag gained a Skills view in analytics (v2.1.311). Code Review no longer reviews an outdated commit when GitHub delivers a push event late (v2.1.312).

8. Beyond the CLI

Two related announcements from these weeks aren’t Claude Code releases:

  • Message threads (beta), November 2. On the Messages API, long conversations and agent loops can keep the conversation on the server with the message-threads-2026-08-12 beta header, so each later request sends only the new messages and gets a lower time to first token. This period’s Claude Code changelog doesn’t mention it. See Claude API message threads.
  • Agent Skills donated to the AAIF, October 22. Anthropic donated the Agent Skills standard, with its name and logo, GitHub organization and agentskills.io domain, to the Agentic AI Foundation under the Linux Foundation; you can use or contribute to the standard without joining the AAIF. See Agent Skills and the Agentic AI Foundation.

What to Do Now

claude --version   # v2.1.318 is the newest release covered here
claude update      # update to the latest version

Solo developers

  1. Update to v2.1.318 for the sandbox and permission fixes.
  2. Decide whether permissions.blockWritesOutsideWorkingDirectories belongs in your user settings.
  3. Expect a typed ultrathink to run its turn at xhigh on the 5.5 models and Fable 5.1 through Anthropic’s API, or set CLAUDE_CODE_DISABLE_ULTRATHINK.
  4. Check subagents on another model, which now use that model’s effort, and set CLAUDE_CODE_SUBAGENT_EFFORT if you want a default.
  5. Move fast mode work from Opus 4.8 to Opus 5.5 before November 30.

If you run claude -p or CI

  1. Fail the job on any non-zero exit from claude -p.
  2. Watch credential_expires_at or the stderr warning, and renew with claude auth login or claude setup-token.
  3. Pass --trust-workspace to claude ultrareview, after the PR number or base branch.
  4. On self-hosted runners, check scripts that run claude -p inside a session or parse orchestrator logs.
  5. Replace any alert built on claude_code.safety_event.

Admins

  1. Adopt the gateway controls in section 6 that you need, and expect a 400 for requests that name a blocked model.
  2. Re-check deniedMcpServers: URL entries now also block Anthropic-provided servers whose upstream URL matches and, where the session is given the connector’s own URL, connectors in cloud sessions and on self-hosted runners (v2.1.318).
  3. Server-managed settings for Team and Enterprise logins now apply without an approval prompt, and a stored copy that doesn’t verify is refused (v2.1.316).
  4. Grant cloud session and Remote Control access through Enterprise custom roles (v2.1.310).

Sources

Every version above has its own page in our release archive. For the period before this one, read the August–October roundup; to learn Claude Code step by step, start at Learn.